Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Virus question (banners being replaced)

[bluecat]

Hi,

I apologize if I'm in the wrong forum alltogether, but figured someone might know the answer to this question. Also, I have searched everywhere for the answer, but can't find a fix.

Is this a virus? Or a problem on the server's end? Many sites I visit replace the banner ads (yahoo a lot) with their own (see attached images). In fact, even this site (at the very top) shows me a "electric guitar" link which I'm sure isn't suppose to be there. When you click the "remove this ad" link, you get this url: amp-modeling.info/remove_this_ads.htm

Any help is greatly appreciated. I've ran my virus removers, spy software, etc. without success.

Thank you.

[bluecat]

And here is what I believe was not put up by this site, but I'm seeing here:

[zoid]

Do you have multiple browsers installed? If so, does it happen in all?

[bluecat]

Yes it happens on IE and Firefox. Also, I just downloaded Wichio's browser, and it does it there too.

[Intersoar]

this sounds like adware displaying banners when you open browsers, like like ad-aware will solve this problem, if it does, hijackthis might also

[rohanch]

It could be that your hosts file has been modified if it is happening in more than one browser. Check C:\Windows\System32\Drivers\etc\ if you use Windows XP.

[bluecat]

Just wanted to say thank you. It was the hosts file which had the following added, if it helps anyone.

72.36.156.164 view.atdmt.com
72.36.156.164 rad.msn.com
72.36.156.164 themis.geocities.yahoo.com
72.36.156.164 us.a1.yimg.com
72.36.156.164 ad.n2434.doubleclick.net
72.36.156.164 n3349ad.doubleclick.net
72.36.156.164 altfarm.mediaplex.com
72.36.156.164 global.msads.net
72.36.156.164 ad.doubleclick.net
72.36.156.164 z1.adserver.com
72.36.156.164 ar.atwola.com
72.36.156.164 ar1.atwola.com